What is the CVSS score of CVE-2026-0013?

CVE-2026-0013 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-0013?

A high-severity privilege escalation vulnerability (CVE-2026-0013) affects Android devices up to version 14.0, allowing local attackers to gain elevated system privileges without additional…

How to fix or mitigate CVE-2026-0013?

Within 24 hours: Audit inventory of Android devices running versions up to 14.0 and assess business-critical exposure. Within 7 days: Communicate vulnerability to device users and restrict access to sensitive applications pending remediation; implement mandatory enrollment in Mobile Device Management (MDM) for affected devices. Within 30 days: Coordinate with device manufacturers for patch availability; enforce mandatory OS updates when available; consider restricting high-risk devices from accessing critical corporate resources until patched.

Google CVE-2026-0013

HIGH

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-03-02 security@android.com

Privilege Escalation Google

8.4

CVSS 3.1 · Vendor: android

Severity by source

Vendor (android) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (android) · only source for this CVE.

CVSS VectorVendor: android

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 19:16 nvd

HIGH 8.4

DescriptionCVE.org

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Android versions up to 14.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).

Technical ContextAI

affects Android. In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.